0

I'm trying to open bisonbrew.com but am getting ERR_CONNECTION_RESET with Chrome, and with Safari:

'Safari can't open the page "https://bisonbrew.com" because Safari can't establish a secure connection to the server "bisonbrew.com".

I tried the steps from this answer but they don't work for OSX 11.6

I tried to at least grab the certificate using openssl and this is the output


$: openssl s_client -showcerts -connect 'bisonbrew.com':443
CONNECTED(00000005)
4673355436:error:14004410:SSL routines:CONNECT_CR_SRVR_HELLO:sslv3 alert handshake failure:/System/Volumes/Data/SWE/macOS/BuildRoots/38cf1d983f/Library/Caches/com.apple.xbs/Sources/libressl/libressl-56.60.2/libressl-2.8/ssl/ssl_pkt.c:1200:SSL alert number 40
4673355436:error:140040E5:SSL routines:CONNECT_CR_SRVR_HELLO:ssl handshake failure:/System/Volumes/Data/SWE/macOS/BuildRoots/38cf1d983f/Library/Caches/com.apple.xbs/Sources/libressl/libressl-56.60.2/libressl-2.8/ssl/ssl_pkt.c:585:
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 0 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : 0000
    Session-ID: 
    Session-ID-ctx: 
    Master-Key: 
    Start Time: 1635268364
    Timeout   : 7200 (sec)
    Verify return code: 0 (ok)
---

Using a different machine this is what I get, which looks correct:

$: openssl s_client -showcerts -connect 'bisonbrew.com':443
CONNECTED(00000003)
depth=2 C = IE, O = Baltimore, OU = CyberTrust, CN = Baltimore CyberTrust Root
verify return:1
depth=1 C = US, O = "Cloudflare, Inc.", CN = Cloudflare Inc ECC CA-3
verify return:1
depth=0 C = US, ST = California, L = San Francisco, O = "Cloudflare, Inc.", CN = sni.cloudflaressl.com
verify return:1
---
Certificate chain
 0 s:C = US, ST = California, L = San Francisco, O = "Cloudflare, Inc.", CN = sni.cloudflaressl.com
   i:C = US, O = "Cloudflare, Inc.", CN = Cloudflare Inc ECC CA-3
-----BEGIN CERTIFICATE-----
...

There are a couple of other sites that aren't working as well (such as www.brewersfriend.com), which led me to suspect it was an issue with my own machine. Any ideas on what is wrong?

1 Answer 1

1

The server requires SNI, i.e. sending the hostname inside the TLS ClientHello. Older versions of OpenSSL did not send this information by default and this is also true for LibreSSL (derived from older OpenSSL) as installed on MacOS.

With these versions the servername has to be given explicitly, i.e.

$ openssl s_client -showcerts -connect bisonbrew.com:443 -servername bisonbrew.com
1
  • Thank you, that actually led to some more profitable results with openssl. I was able to retrieve the cert successfully. I could not validate the cert as I was "unable to get the local issuer certificate" - or something to that effect because I cannot reproduce the error now. Mysteriously the sites are working again.
    – fthinker
    Oct 27, 2021 at 16:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .